HijackLoader/CastleLoader DLL side-load via signed binary loading unsigned DLL
This rule detects DLL side-loading attempts by identifying signed processes that load unsigned or invalidly signed DLLs from the same directory as the initiating process, specifically excluding standard system directories (System32, SysWOW64, WinSxS) to reduce noise. This behavior is a common technique used by attackers to execute malicious code under the context of a trusted, legitimate application.
Microsoft Sentinel (KQL)
